Hot answers tagged

5

About Chrome According to https://www.google.com/chrome/browser/privacy/whitepaper.html In the event that Chrome detects SSL connection timeouts, certificate errors, or other network issues that might be caused by a captive portal (a hotel's WiFi network, for instance), Chrome will make a cookieless request to http://www.gstatic.com/generate_204 ...


5

Everything is authenticated based upon the mac address of your wireless card. When you connect initially you are assigned a DHCP address by the gateway device which is controlling your DNS. Before you are authenticated all DNS requests are redirected to the HTTP(S) server of the gateway device. This controller has created you an account based upon your mac ...


3

curiousguy is correct that Tor doesn't actually obfuscate the protocol other than HTTPS. Of note, however, is that Tor (using something like Tor Browser or Vidalia) does proxy DNS requests through Tor. Some captive portals work only by redirecting default DNS to a login portal. If this is the case, the combination of encrypted communication and third-party ...


3

So it appears that this service is vulnerable to MAC spoofing. I'm not sure that I see a direct security concern threat here. You've demonstrated that you can bypass their licensing to access the service for free. That's not necessarily a security problem. But as @AndréBorie has pointed out, activity performed by the MAC spoofer will appear to come from ...


3

The browser does not know anything about the authentication. It is done on the outside: outgoing connections are intercepted. This can be done in several ways; usually, the WiFi router intercepts outgoing TCP connections, and, if the contents of the connection look like an HTTP request, the router serves back the 'pay me' page; all other connections are ...


2

Many captive portals are a self contained httpd/dhcpd/router/whatever else (some routers have bittorrent clients but that is beside the point). I don't think that this Wikipedia page disagrees with that. The attack being discussed in the last part of this excerpt is referring to DNS tunneling. If its a very large network, such as a WISP, then they are ...


2

There are a large number of open source hotspot software suites available. EasyHotSpot has an integrated billing system. I have not audited these applications and i have no idea how secure they are. From a security perspective, "captive portals" break ssl pretty badly. Convergence, which is the Anti-MITM addon for firefox will detect captive portals as ...


2

Not just OSX but most platforms now will request a known URL and see whether the content is replaced or tampered with to detect hotspots. Windows 7+ : NCSI performs a DNS lookup on www.msftncsi.com, then requests http://www.msftncsi.com/ncsi.txt. This file is a plain-text file and contains only the text Microsoft NCSI. NCSI sends a DNS lookup ...


2

It's depends and might be messy. Under OS X, I follow Cupertino's method and add networking connection link state monitoring in a script which fetches and compares the contents http://www.thinkdifferent.us. Plus, I have a manual toggle script for slow links, incompletely-blocking captive portals and downloading Apple updates from this hemisphere, which are ...


2

I'll let someone else answer about how the iOS captive portal interface displays certificate status and whether the captive portal is served over HTTPS, but I do know a solution. When connecting to an open Wi-Fi, dismiss the captive portal sheet then click on the network entry's "i" icon on the right in the Wi-Fi network list. That will display properties ...


1

I'm sure that Apple tries to make it secure but there's no real way to know exactly how they define "secure". As it sounds like you have some fairly strict requirements for considering such a connection secure, I'd assume that what the OS provides is using a lower standard. So, if you can, open the page in your browser and perform your standard security ...


1

There are two enterprise level approaches (apart from banning of course! which many do). The OS firewall can be made to ban direct connections from all applications. This can be combined with some app to handle the initial VPN connection. It should be made to allow access direct to the Internet for a short period or until the VPN connection is made. It ...


1

On the one hand, as it has been stated, I think that the DDoS risk is definitely not the reason why you should block ICMP. On the other hand, if ICMP or DNS is allowed, you can open a tunnel with a remote host over this protocol and totally bypass the captive portal. If those protocols are not blocked (or at the very least monitored), you basically have ...


1

Relevant answer to an existing question here: Can a captive portal be secured You can generate a session key and store it in a cookie client side which contains a session token to authenticate the client to the Proxy (yes proxy!). (do make sure it's sent over HTTPS as otherwise it's completely useless) The proxy does bring a limitation when it comes ...


1

You can generate a session key and store it in a cookie client side which is contains a session token to authenticate the client to the Proxy (yes proxy!). (do make sure it's sent over HTTPS as otherwise it's completely useless) The proxy does bring a limitation when it comes to other types of traffic such as SSH (taking out of scope that your users know ...



Only top voted, non community-wiki answers of a minimum length are eligible